KR20200022936A - Method for providing virtual working environment by using user context-aware and virtual desktop infrastructure server using the same - Google Patents

Abstract

An application of the present invention relates to a method for providing a virtual working environment by user context and a VDI server using the same. According to one embodiment of the present invention, the method for providing a virtual working environment by user context of the VDI server capable of increasing security may comprise the steps of: receiving an access request from a user terminal; collecting context information on the user terminal in response to the access request; determining a connection status of the user terminal using the context information and setting a virtual working environment corresponding to the connection status; and providing a virtual desktop service to the user terminal according to the virtual working environment.

Description

Method for providing virtual working environment by using user context-aware and virtual desktop infrastructure server using the same}

The present application relates to a virtual work environment providing method for each user situation that can provide a different virtual work environment according to the access situation that the user is connected and a VDI server using the same.

Recently, a lot of research and standardization of the virtual desktop service as a service for providing data storage hard disks and applications to the Internet space has been conducted. Korean Unexamined Patent Publication Nos. 2010-0123847, 2009-0111576, 2009-0111576 and the like disclose a virtual desktop service technology in detail.

Virtual Desktop Service is a service that provides hard disks and applications for storing data in the Internet space, and corresponds to a service that accesses and uses a virtual machine running on a virtual desktop server to a client system.

The present application is to provide a method for providing a virtual work environment for each user context and a VDI server using the same, which can provide a different virtual work environment according to a connection situation that a user accesses.

The present application is to provide a method for providing a virtual work environment for each user situation and a VDI server using the same, which can improve security by setting access rights and management rights according to a user's access situation.

According to an embodiment of the present invention, a method for providing a virtual work environment for each user context of a VDI server may include: receiving a connection request from a user terminal; Collecting contextual information about the user terminal in response to the access request; Determining a connection status of the user terminal by using the status information and setting a virtual work environment corresponding to the connection status; And providing a virtual desktop service to the user terminal according to the virtual business environment.

In the collecting of the situation information, whether or not to apply an internal security policy in the user terminal, a type of authentication scheme provided by the user terminal, an access request time and an access request place of the user terminal may be collected as the context information. Can be.

Here, the contextual information collecting step may be collected as the contextual information by checking whether a module that executes one of the internal security policies of the DRM, the DLP, and the i-Privacy in the user terminal is installed.

Here, the collecting status information may determine whether the authentication scheme provided by the user terminal corresponds to one-step authentication of ID-password and two-step authentication further including additional authentication together with ID-password. The type of authentication scheme provided by the terminal may be collected as the context information.

Here, the collecting status information may include checking the connection request time when the connection request is received from the user terminal, determining whether the connection request time belongs to a work time or a non-work time, and collecting the situation information. have.

Wherein the situation information collection step, after checking whether the communication network receiving the connection request from the user terminal belongs to the enterprise security communication network and the general communication network, if the enterprise security communication network, and determines the connection request place in-house, the general In the case of a communication network, the connection request place may be discriminated outside and collected as the situation information.

Here, in the context information collection step, if the communication network receiving the connection request corresponds to any one of mVPN, P-LET, and a leased line, it is determined that it corresponds to the enterprise security communication network, and the communication network receiving the connection request is LTE. Alternatively, if it corresponds to a LAN, it may be determined to correspond to the general communication network.

Here, in the virtual work environment setting step, if the in-house security policy is not applied to the user terminal or the authentication method provided by the user terminal is one-step authentication, the connection status is determined as the blocked connection status, and the user terminal is determined. In-house security policy is applied, and if the authentication scheme provided by the user terminal is two-step authentication, the access situation is set to the restricted access situation, the company security policy is applied to the user terminal, provided by the user terminal When the authentication method is two-step authentication, the connection request time of the user terminal is a business time, and the connection request place is in-house, the connection situation may be set as a safe connection situation.

Here, the virtual business environment setting step, in the case of the safe connection situation, allows access to the in-house application and in-house data installed in the VDI server, and provides a first management authority for the in-house application and in-house data to provide the virtual Set a work environment, in the case of the limited access situation, allows access to a predetermined approval application and approval data among the in-house applications and the in-house data installed in the VDI server, and the second management authority for the approval application and the approval data. Set the virtual business environment by providing a, and in the case of the blocked connection situation, block access to the internal applications and internal data installed in the VDI server, and allow access to the external applications and external data installed in the VDI server And the external application And providing third management authority for external data to set the virtual business environment.

The virtual work environment setting step may include the installation, removal, modification, and access rights for the in-house application, and the storage, deletion, modification, and inquiry rights for the in-house data as the first management authority, and the second management authority. The management authority provides access authority for the approval application and inquiry authority for the approval data, and the third management authority provides installation, removal, modification and access authority for the external application, storage of the external data, You can provide delete, modify, and view permissions.

According to an embodiment of the present invention, there may be a computer program stored in a medium in combination with hardware to execute the above-described method for providing a virtual work environment for each user context of the VDI server.

VDI (Virtual Desktop Infrastructure) server according to an embodiment of the present invention, the receiving unit for receiving a connection request from the user terminal; A context information collecting unit configured to collect context information of the user terminal in response to the access request; A virtual work environment setting unit which determines a connection situation of the user terminal by using the situation information and sets a virtual work environment corresponding to the connection situation; And according to the virtual business environment, may include a service providing unit for providing a virtual desktop service to the user terminal.

According to another embodiment of the present invention, a virtual desktop infrastructure (VDI) server includes a processor; And a memory coupled to the processor, wherein the memory includes one or more modules configured to be executed by the processor, wherein the one or more modules receive a connection request from a user terminal and receive the connection request. Correspondingly, collecting situation information about the user terminal, determining the connection situation of the user terminal using the situation information, setting a virtual work environment corresponding to the connection situation, according to the virtual work environment, It may include a command for providing a virtual desktop service to the user terminal.

In addition, the solution of the said subject does not enumerate all the characteristics of this invention. Various features of the present invention and the advantages and effects thereof may be understood in more detail with reference to the following specific embodiments.

According to a method for providing a virtual work environment for each user context and a VDI server using the same according to an embodiment of the present invention, a virtual work environment having different rights may be provided according to a connection situation in which a user is connected. That is, since the user's access rights and the like can be restricted according to the user's connection situation, security of the company's work system can be improved.

1 is a schematic diagram showing a system for providing a virtual work environment for each user context according to an embodiment of the present invention.
2 and 3 are block diagrams illustrating a VDI server according to an embodiment of the present invention.
4 is a table showing the connection status determination according to the status information according to an embodiment of the present invention.
5 is a table showing right rights according to a connection situation according to an embodiment of the present invention.
6 is a schematic diagram showing a change in connection status according to an embodiment of the present invention.
7 is a flowchart illustrating a method for providing a virtual work environment for each user context according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. However, in describing the preferred embodiment of the present invention in detail, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, the same reference numerals are used throughout the drawings for parts having similar functions and functions.

In addition, throughout the specification, when a part is 'connected' to another part, it is not only 'directly connected' but also 'indirectly connected' with another element in between. Include. In addition, the term 'comprising' a certain component means that the component may further include other components, not to exclude other components unless specifically stated otherwise. In addition, the terms "?", "Module", etc. described in the specification mean a unit for processing at least one function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

1 is a view showing a virtual work environment providing system for each user context according to an embodiment of the present invention.

Referring to FIG. 1, a system for providing a virtual work environment for each user context according to an embodiment of the present invention may include a user terminal 1 and a VDI (Virtual Desktop Infrastructure) server 100.

Hereinafter, a system for providing a virtual work environment for each user situation according to an embodiment of the present invention will be described with reference to FIG. 1.

The user terminal 1 may access the VDI server 100 through a communication network and receive a virtual desktop service from the VDI server 100. Here, the user terminal 1 may be a mobile terminal such as a smartphone, a tablet PC, a notebook, and the like, and in some embodiments, a fixed device such as a desktop may be included. Specifically, the user terminal 1 includes a mobile phone, a smart phone, a laptop computer, a digital broadcasting terminal, a personal digital assistant (PDA), a portable multimedia player (PMP), a slate PC, A tablet PC, an ultrabook, a wearable device (eg, a smartwatch, a glass glass, a head mounted display) may be included. .

Here, the communication network may include a wired network and a wireless network, and may include various networks such as a local area network (LAN), a metropolitan area network (MAN), and a wide area network (WAN). have. In addition, the communication network may include a well-known World Wide Web (WWW). However, the communication network according to the present invention is not limited to the networks listed above, and may include a known wireless data network, a known telephone network, a known wired or wireless television network, and the like.

The VDI server 100 may provide a virtual desktop service to the user terminal 1. Here, the virtual desktop service reproduces the user's desktop computer online. In some embodiments, the virtual desktop service may provide a work environment online by virtualizing the user's work desktop. In this case, the company's in-house business system (legacy system) may be connected to the VDI server 100, or the in-house business system itself may be virtualized in the VDI server 100. Through this, the VDI server 100 may provide a user with a virtual work environment in which a user may access an in-house work system and perform a work.

The VDI server 100 may provide different virtual desktop services for each user, and may provide an independent storage space for each user. Here, applications or data stored by individual users through the virtual desktop service may be distributed and stored in storage (s).

Here, the user can be freely provided with his / her work environment regardless of time and place through the virtual desktop service. However, since the user can freely access the company's work system from the outside, there is a risk of security problems.

To solve this problem, it is necessary to provide a service by setting a virtual work environment for each user's situation, and according to the VDI server 100 according to an embodiment of the present invention, various virtual work environments are provided according to a user's connection status. To improve security.

2 is a block diagram illustrating a VDI server according to an embodiment of the present invention.

Referring to FIG. 2, the VDI server 100 according to an embodiment of the present invention may include a receiver 110, a situation information collector 120, a virtual business environment setup unit 130, and a service provider 140. Can be.

Hereinafter, the VDI server 100 according to an embodiment of the present invention will be described with reference to FIG. 2.

The receiver 110 may receive a connection request from the user terminal 1. When the user wants to be provided with the virtual desktop service, the user may access the VDI server 100 using the user terminal 1 and transmit a connection request to the VDI server 100.

In this case, the receiving unit 110 may receive an access request from the user terminal 1, and may confirm a request for providing a virtual desktop service of the corresponding user terminal 1 through the access request. Thereafter, the receiver 110 may request the context information collecting unit 120 to collect context information about the corresponding user terminal 1.

The contextual information collecting unit 120 may collect contextual information about the user terminal 1 in response to the access request. The contextual information collecting unit 120 may collect various kinds of contextual information about the user terminal 1, and according to an embodiment, whether the internal security policy of the user terminal 1 is applied or not, The type of authentication scheme to be provided, the connection request time of the user terminal 1, the connection request place of the user terminal 1, and the like may be collected as situation information.

Specifically, whether to apply the internal security policy of the user terminal 1, whether the module for executing the internal security policy, such as DRM (Digital Rights Management), DLP (Data Loss Prevention), i-privacy is installed in the user terminal (1) This can be determined by checking. Through this, the context information collecting unit 120 may determine whether the respective user terminals 1 apply the internal security policy, and collect whether the internal security policy is applied as the context information of the corresponding user terminal 1. have.

In addition, the type of authentication method provided by the user terminal 1 may be determined by checking a user authentication method performed by the user terminal 1 to access the VDI server 100. The user terminals 1 access the VDI server 100 through one-step authentication for inputting only the ID-password, or perform two-step authentication for further authentication after inputting the ID-password, thereby performing the VDI server 100. ) Can be accessed. Here, the additional authentication may be bio authentication using bio information such as a fingerprint or iris of the user, or occupancy authentication using a Short Message Servcie (SMS) message or the like. In this case, the context information collecting unit 120 checks whether the authentication method provided by the user terminal 1 is one-step authentication according to ID-password input or two-step authentication further including additional authentication such as bio authentication. Through this, authentication methods provided by the respective user terminals 1 may be collected as contextual information.

In addition, the connection request time of the user terminal 1 can be determined by a method of confirming whether the time point when the user terminal 1 requests connection belongs to one of a work time and a non-work time. For example, when the time when the connection request is received is between 9 am and 6 pm, it may be determined as a work time, and when it falls outside the time range, it may be determined as non-work time. Through this, the context information collecting unit 120 may collect context information about the access request time of the user terminal 1.

On the other hand, the connection request place of the user terminal 1 can determine whether the user terminal 1 is located inside or outside the company. Here, although the connection request location may be checked according to the actual physical location of the user terminal 1, according to the embodiment, the internal and external may be distinguished according to the communication network to which the user terminal 1 is connected. That is, when the user terminal 1 is connected through the corporate security communication network, it is determined that the location of the user terminal 1 is located in the company, and when the user terminal 1 is connected to the general communication network, the user terminal 1 It can be determined that it is located outside. When the user terminal 1 is connected through an enterprise security communication network, security can be secured in communication with the user terminal 1, so that the same effect as that of the user terminal 1 is located in the company can be obtained. have. On the other hand, when the user terminal 1 is connected to the general communication network can not secure the security of the communication, it can be seen that the location outside the user terminal 1 irrespective of the location.

Therefore, the context information collecting unit 120 may check whether the communication network that receives the connection request from the user terminal 1 belongs to one of the enterprise security communication network and the general communication network, and in the case of the enterprise security communication network, determine the connection request place in-house. can do. On the other hand, in a general communication network, the connection request place can be discriminated outside and collected as situation information. Herein, the enterprise security communication network may include a mobile virtual private network (mVPN), a private-long term evolution (P-LTE), a dedicated line, and the like, and a general communication network may include a long term evolution (LTE) or a local area network (LAN). Etc. may be included.

The contextual information collecting unit 120 may collect contextual information of the user terminal 1 whenever the user terminal 1 is connected, and provide the collected contextual information to the virtual work environment setting unit 130.

The virtual work environment setting unit 130 may determine a connection situation of the user terminal 1 using the situation information, and may set a virtual work environment corresponding to the determined connection condition.

First, the virtual business environment setting unit 130 may determine the connection status of each user terminal 1 from the received situation information. As shown in FIG. 4, according to an embodiment, the user terminal 1 Can be classified into safe connection status, restricted connection status, and disconnected connection status.

Specifically, the virtual work environment setting unit 130 does not apply the internal security policy to the user terminal 1, or if the authentication method provided by the user terminal 1 is a one-step authentication, the connection status to the blocked connection status Can be determined. That is, as in the user terminal C of FIG. 4, when the in-house security policy is not applied and the authentication method is one step, it may be determined as a blocked connection situation.

On the other hand, when the in-house security policy is applied to the user terminal 1, and at the same time the authentication method provided by the user terminal 1 is two-step authentication, the connection situation can be set to the restricted access situation. That is, as in the user terminal B of FIG. 4, when the in-house security policy is applied and the authentication method is two-stage, it may be determined as the restricted access situation. According to the embodiment, in the limited connection situation and the disconnected connection situation, it is also possible to determine the connection status by further considering the connection request time and the connection request place of the user terminal 1.

On the other hand, the internal security policy is applied to the user terminal 1, the authentication method provided by the user terminal 1 is two-step authentication, the connection request time of the user terminal 1 is a business time, the connection request place is in-house In case of, the connection status can be set as the safety connection status. That is, as in the user terminal A of FIG. 4, an in-house security policy is applied, a two-step authentication scheme is used, and when connected in-house within the working hours, it can be set as a safe connection situation.

Thereafter, as shown in FIG. 5, the virtual business environment setting unit 130 sets access rights and management rights for applications and data according to respective connection conditions, thereby setting the virtual business environment of the user terminal 1. Can be. Here, the in-house application may include enterprise resource planning (ERP), supply chain management (SCM), product lifecycle management (PLM), network management system (NMS), contract management, human resource management (HRM), and the like.

In detail, when the connection situation is determined as the safe connection situation, the secure connection virtual work environment may be generated. That is, the virtual work environment may be set to allow the user terminal 1 access to all in-house applications and all in-house data installed in the VDI server 100 and to provide first management rights to the in-house applications and in-house data. . Here, the first management authority may include an installation, removal, change, and access right for an in-house application, and a storage, deletion, modification, and inquiry right for an in-house data. In the case of a secure connection situation, since the user terminal 1 is securely secured, the user terminal 1 may provide a wide range of access rights and management rights.

In addition, in the limited access situation, the restricted access virtual business environment may be created. That is, the virtual work environment may be set to allow access only to the predetermined approval application and the approval data among the entire in-house application and the entire in-house data, and provide a second management authority for the approval application and the approval data. In the limited access situation, since the security of the user terminal 1 is relatively weak, only the predetermined approval application and the approval data may be allowed to access, not the entire in-house application. Here, the approval application may include a contract management or HRM. The second management authority granted to the user terminal 1 includes only the access authority for the approval application and the inquiry authority for the approval data, and the user terminal 1 installs, removes, or changes the in-house application. It may not be allowed to save, delete or modify the data.

On the other hand, in the case of a blocking connection situation, all access to the in-house application and the in-house data installed in the VDI server 100 may be blocked. That is, since the security cannot be guaranteed in the blocked connection situation, the virtual work environment setting unit 130 may set the blocked access virtual work environment to block the user terminal 1 from accessing the company application or the company data.

However, in addition to the in-house application or the in-house data, access is allowed to the outside application and the outside data installed in the VDI server 100, and the third management authority for the outside application and the outside data may be provided. Here, the third management authority may include an installation, removal, modification, and access right for an external application, and a storage, deletion, modification, and inquiry right for the external data. Access to third-party applications and external data and third party rights may also be provided in insecure or restricted access situations.

The service provider 140 may provide a virtual desktop service to the user terminal 1 according to the set virtual work environment. The service provider 140 may provide a virtual desktop service corresponding to any one of a safe access virtual work environment, a limited access virtual work environment, and a blocked access virtual work environment according to a connection state of each user terminal 1. have. Through this, the user may be provided with a virtual desktop service corresponding to the connection situation.

In addition, as shown in FIG. 6, there may be an exception of the virtual business environment provided to the user terminal 1.

Specifically, in order to provide a safe access virtual work environment, when the user accesses in-house within the office using the user terminal 1 to which the internal security policy is applied, but the user fails two-step authentication and only completes the first-step authentication. There can be. In this case, the service provider 140 may provide the virtual desktop service of the limited access virtual business environment to the user terminal 1 (C1).

In addition, in order to be provided with a restricted access virtual business environment, when connected outside the office within the working hours, but the internal security policy is not applied to the user terminal (1) carried by the user, the virtual desktop service of the blocked access virtual business environment It can be provided (C2).

On the other hand, even when a user accesses outside the office during non-business hours, if the user performs a two-step authentication to the user terminal 1 to which the internal security policy is applied, the virtual desktop service of the blocked access virtual business environment can be provided ( C3). In this case, depending on the embodiment, approval from the administrator may be requested in advance.

In addition, when the user connects outside the office during the working hours, if the user performs a two-step authentication to the user terminal 1 to which the internal security policy is applied, it is also possible to receive a virtual desktop service of the secure access virtual work environment (C4). ). Also in this case, approval from the manager may be requested in advance.

On the other hand, as shown in Figure 3, the VDI server 100 according to an embodiment of the present invention, may include a physical configuration of the processor 10, memory 40, and the like, the memory 40 May include one or more modules configured to be executed by the processor 10. Specifically, the one or more modules may include a receiving module, a situation information collecting module, a virtual business environment setting module, a service providing module, and the like.

The processor 10 may execute various software programs and an instruction set stored in the memory 40 to perform various functions and to process data. The peripheral interface unit 30 may connect an input / output peripheral of the VDI server 100 to the processor 10 and the memory 40, and the memory controller 20 may be configured as the processor 10 or the VDI server 100. In the case where an element accesses memory 40, it may perform the function of controlling memory access. According to an embodiment, the processor 10, the memory controller 20, and the peripheral interface unit 30 may be implemented on a single chip or may be implemented as separate chips.

The memory 40 may include fast random access memory, one or more magnetic disk storage devices, nonvolatile memory such as a flash memory device, and the like. In addition, the memory 40 may further include a storage device located away from the processor 10 or a network-attached storage device accessed through a communication network such as the Internet.

As shown in FIG. 3, the VDI server 100 according to an embodiment of the present invention includes an operating system in a memory 40, a reception module corresponding to an application program, a situation information collection module, and a virtual business environment setting module. And a service providing module. Here, each module may be stored in the memory 40 as a set of instructions for performing the above-described function.

Accordingly, the VDI server 100 according to an embodiment of the present invention may allow the processor 10 to access the memory 40 and execute instructions corresponding to each module. However, the reception module, the situation information collection module, the virtual work environment setting module, and the service providing module correspond to the above-described receiver, the situation information collecting unit, the virtual work environment setting unit, and the service providing unit, respectively, and thus detailed description thereof will be omitted.

7 is a flowchart illustrating a method for providing a virtual work environment for each user context of a VDI server according to an embodiment of the present invention.

Referring to FIG. 7, the method for providing a virtual work environment for each user context according to an embodiment of the present invention includes a connection request reception step (S10), a situation information collection step (S20), a virtual work environment setting step (S30), and a service provision. Step S40 may be included.

Hereinafter, a method for providing a virtual work environment for each user situation according to an embodiment of the present invention will be described with reference to FIG. 7.

In the connection request reception step (S10), it is possible to receive a connection request from the user terminal. When the user wants to be provided with the virtual desktop service, the user may access the VDI server using the user terminal and transmit a connection request to the VDI server. Accordingly, the access request may be received from the user terminal through the access request reception step (S10), and the request for providing the virtual desktop service of the corresponding user terminal may be confirmed through the access request.

In the context information collecting step (S20), the context information on the user terminal may be collected in response to the access request. Here, various kinds of situation information can be collected, and according to the embodiment, whether or not the security policy of the user terminal is applied, the type of authentication method provided by the user terminal, the access request time of the user terminal, the place of the connection request, etc. Can be collected.

Specifically, whether to apply the internal security policy of the user terminal may be determined by checking whether a module for executing an internal security policy such as DRM, DLP, i-privacy or the like is installed in the user terminal. Through this, it is possible to determine whether each user terminal is applied in-house security policy, and whether to apply the company security policy can be collected as the status information of the user terminal.

In addition, the type of authentication method provided by the user terminal may be determined by checking a user authentication method performed by the user terminal to access the VDI server. The user terminals may access the VDI server through one-step authentication for inputting only the ID-password or may perform two-step authentication for further authentication after inputting the ID-password to access the VDI server. Here, the additional authentication may be bio-authentication using bio-information such as a user's fingerprint or iris, or occupancy authentication performed through SMS (Short Message Servcie). In this case, whether the authentication method provided by the user terminal is one-step authentication according to ID-password input or two-step authentication further including additional authentication such as bio authentication can be checked. Authentication methods can be collected as contextual information.

Here, the connection request time of the user terminal can be determined by a method of confirming whether the point in time at which the user terminal requests the connection belongs to a work time or a non-work time.

On the other hand, the connection request place of the user terminal can distinguish between the inside and the outside according to the communication network to which the user terminal is connected. That is, when the user terminal is connected through an enterprise security communication network, it may be determined that the location of the user terminal is located in the company, and when the user terminal is connected to the general communication network, it may be determined that the user terminal is located outside the company. Here, the corporate security communication network may be mVPN, P-LET and leased line, and the general communication network may be LTE or LAN.

In the virtual business environment setting step (S30), it is possible to determine the connection status of the user terminal by using the status information, and set the virtual business environment corresponding to the connection status.

First, in the virtual business environment setting step (S30), the connection situation of the user terminal may be classified into a safety connection situation, a restricted connection situation, and a blocked connection situation.

In detail, when the in-house security policy is not applied to the user terminal or when the authentication scheme provided by the user terminal is one-step authentication, the access situation may be determined as the blocked access situation. On the other hand, if the in-house security policy is applied to the user terminal, and at the same time the authentication scheme provided by the user terminal is two-step authentication, the access situation can be set to the restricted access situation. According to the embodiment, in the limited connection situation and the disconnected connection situation, it is also possible to determine the connection status by further considering the connection request time or the connection request place of the user terminal.

On the other hand, if the internal security policy is applied to the user terminal, the authentication method provided by the user terminal is two-step authentication, the connection request time of the user terminal is the business time, and the connection request place is in-house, and the connection status is secured. Can be set with

Thereafter, in the virtual work environment setting step (S30), the access right and the management right for the application and the data may be set according to each connection situation, thereby setting the virtual work environment of the user terminal. Here, the in-house application may include ERP, SCM, PLM, NMS, contract management, HRM.

In detail, when the connection situation is determined as the safe connection situation, the secure connection virtual work environment may be generated. That is, the virtual work environment may be set to allow the user terminal access to all the in-house applications and all the in-house data installed in the VDI server and to provide the first management authority for the in-house application and the in-house data. Here, the first management authority may include an installation, removal, change, and access right for an in-house application, and a storage, deletion, modification, and inquiry right for an in-house data. In the case of a secure connection situation, since the user terminal is in a secure state, it can provide a wide range of access rights and management rights to the user terminal.

In addition, in the limited access situation, the restricted access virtual business environment may be created. That is, the virtual work environment may be set to allow access only to the predetermined approval application and the approval data among the entire in-house application and the entire in-house data, and provide a second management authority for the approval application and the approval data. In the limited access situation, since the security of the user terminal is relatively weak, it is possible to allow access only to the predetermined approval application and the approval data, not the entire in-house application. Here, the approval application may include a contract management or HRM. The second administrative authority granted to the user terminal includes only the access authority for the approval application and the inquiry authority for the approval data, and the user terminal installs, removes, or changes the internal application, or stores, deletes, or modifies the internal data. May not be allowed.

On the other hand, in the case of a blocked connection situation, it is possible to block all access to the in-house application and the in-house data installed in the VDI server. That is, since security cannot be guaranteed in the blocked access situation, the blocked access virtual work environment may be set to block the user terminal from accessing the internal application or the internal data.

However, in addition to the in-house application or the in-house data, access is allowed to the outside application and the outside data installed in the VDI server, and the third management authority for the outside application and the outside data may be provided. Here, the third management authority may include an installation, removal, change, and access right for an external application, and a storage, deletion, modification, and inquiry right for the external data. Access to third-party applications and external data and third party rights can also be provided in insecure or restricted access situations.

In the service providing step (S40), according to the virtual business environment, it is possible to provide a virtual desktop service to the user terminal. That is, according to the connection situation of each user terminal, it is possible to provide a virtual desktop service corresponding to any one of a secure access virtual work environment, a limited access virtual work environment, and a blocked access virtual work environment. Through this, the user may be provided with a virtual desktop service corresponding to the connection situation.

The present invention described above can be embodied as computer readable codes on a medium in which a program is recorded. The computer readable medium may be to continuously store a computer executable program or to temporarily store a program for execution or download. In addition, the medium may be a variety of recording means or storage means in the form of a single or several hardware combined, not limited to a medium directly connected to any computer system, it may be distributed on the network. Examples of media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, And ROM, RAM, flash memory, and the like, configured to store program instructions. In addition, examples of another medium may include a recording medium or a storage medium managed by an app store that distributes an application, a site that supplies or distributes various software, a server, or the like. Accordingly, the above detailed description should not be construed as limiting in all aspects and should be considered as illustrative. The scope of the present invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the present invention are included in the scope of the present invention.

The present invention is not limited by the above-described embodiment and the accompanying drawings. It will be apparent to those skilled in the art that the present invention may be substituted, modified, and changed in accordance with the present invention without departing from the spirit of the present invention.

1: user terminal 100: VDI server
110: receiving unit 120: situation information collecting unit
130: virtual business environment setting unit 140: service provider
S10: access request receiving step S20: situation information collecting step
S30: virtual business environment setting step S40: service providing step

Claims (13)

In the virtual work environment providing method of the VDI (Virtual Desktop Infrastructure) server by user situation,
Receiving an access request from a user terminal;
Collecting contextual information about the user terminal in response to the access request;
Determining a connection status of the user terminal by using the status information and setting a virtual work environment corresponding to the connection status; And
And providing a virtual desktop service to the user terminal according to the virtual business environment.
The method of claim 1, wherein collecting the situation information
Whether or not to apply the internal security policy in the user terminal, the type of authentication scheme provided by the user terminal, the access request time and the place of the user terminal as the situation information, characterized in that the collection of the VDI server How to provide a virtual work environment.
The method of claim 2, wherein the collecting status information
Method of providing a virtual work environment for each user context of the VDI server, characterized in that the module to check whether the module for executing the security policy of any one of the DRM, DLP, and i-Privacy in the user terminal is installed.
The method of claim 2, wherein the collecting status information
Determine whether the authentication scheme provided by the user terminal corresponds to one-step authentication of ID-password and two-step authentication further including additional authentication together with the ID-password, and the type of authentication scheme provided by the user terminal. Method for providing a virtual work environment for each user context of the VDI server, characterized in that collecting the context information.
The method of claim 2, wherein the collecting status information
Checking the access request time received from the user terminal from the user terminal, and determines whether the access request time belongs to the business time and non-business hours, and collects the situation information of the VDI server How to provide virtual work environment for each.
The method of claim 2, wherein the collecting status information
After checking whether the communication network that has received the access request from the user terminal belongs to an enterprise security communication network or a general communication network, if the enterprise security communication network, the connection request place is determined in-house, and if the general communication network, the connection request place is external. Method for providing a virtual work environment for each user context of the VDI server, characterized in that to collect as the situation information to determine.
The method of claim 6, wherein the collecting status information
If the communication network that receives the access request corresponds to any one of mVPN, P-LET, and a leased line, it is determined that the communication network corresponds to the enterprise security communication network, and when the communication network that receives the access request corresponds to LTE or LAN, the general communication network Method for providing a virtual work environment for each user situation of the VDI server, characterized in that determined to correspond to.
The method of claim 2, wherein the virtual business environment setting step
If the internal security policy is not applied to the user terminal or the authentication method provided by the user terminal is one-step authentication, the connection status is determined as a blocked connection status,
In-house security policy is applied to the user terminal, and if the authentication scheme provided by the user terminal is two-step authentication, set the access situation to the restricted access situation,
If the internal security policy is applied to the user terminal, the authentication scheme provided by the user terminal is two-step authentication, the access request time of the user terminal is a business time, the access situation is secured in the company A virtual work environment providing method for each user situation of a VDI server, characterized by setting in a connection situation.
The method of claim 8, wherein the virtual business environment setting step
In the case of the secure connection situation, allowing access to the in-house application and in-house data installed in the VDI server, and providing the first management authority for the in-house application and in-house data to set the virtual business environment,
In the limited access situation, allowing access to a predetermined approval application and approval data among in-house applications and in-house data installed in the VDI server, and providing a second management authority for the approval application and the approval data to provide the virtual service. Set up the environment,
In the blocking connection situation, the access to the internal applications and internal data installed in the VDI server is blocked, the access to the external applications and external data installed in the VDI server is allowed, and the external applications and external data are controlled. 3 The virtual work environment providing method for each user situation of the VDI server, characterized in that for setting the virtual work environment by providing management authority.
10. The method of claim 9, wherein the virtual business environment setting step
The first management authority provides the installation, removal, modification and access rights for the in-house application, and the storage, deletion, modification and inquiry rights for the in-house data.
The second management authority provides access authority for the approval application and inquiry authority for the approval data,
The virtual management environment for each user situation of the VDI server, wherein the third management authority provides installation, removal, modification, and access authority for the external application, and storage, deletion, modification, and inquiry authority for the external data. How to Provide.
A computer program stored in a medium in combination with hardware to execute a method for providing a virtual work environment for a user context of a VDI server according to any one of claims 1 to 11.
Receiving unit for receiving a connection request from the user terminal;
A context information collecting unit configured to collect context information of the user terminal in response to the access request;
A virtual work environment setting unit which determines a connection situation of the user terminal by using the situation information and sets a virtual work environment corresponding to the connection situation; And
According to the virtual business environment, a virtual desktop infrastructure (VDI) server including a service providing unit for providing a virtual desktop service to the user terminal.
A processor; And
Including a memory coupled to the processor,
The memory includes one or more modules configured to be executed by the processor, wherein the one or more modules include:
Receive a connection request from the user terminal,
In response to the access request, collecting contextual information about the user terminal;
The connection status of the user terminal is determined using the status information, and a virtual work environment corresponding to the connection status is set,
In accordance with the virtual business environment, providing a virtual desktop service to the user terminal,
Virtual Desktop Infrastructure (VDI) server containing commands.

Images